CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Summary
## Summary In `backpropagate >= 1.1.0`, the optional Reflex web UI (`pip install backpropagate[ui]`, launched via `backprop ui`) exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing flags intended as security controls: - `--auth user:pass` — documented as "require HTTP Basic authentication on every request to the UI." - `--share` — documented as "expose the UI on a public address; requires `--auth`." When `--auth user:pass` is passed, the CLI prints `Auth: enabled (user: )` to confirm to the operator that authentication is active, then exports `BACKPROPAGATE_UI_AUTH=user:pass` to the subprocess that launches the Reflex backend. **The Reflex backend (`backpropagate/ui_app/**`) never reads `BACKPROPAGATE_UI_AUTH`.** No authentication middleware is registered. No request-level guard runs. No WebSocket upgrade guard runs. Any client that reaches the bound port — local or remote, depending on whether `--share` is used — has full UI access. An inline comment at `backpropagate/cli.py:1217-1218` in the v1.1.0 source documents the gap: *"For Phase 1 the variable is exported but Reflex doesn't read it yet."* This comment was internal-facing; the user-facing documentation (README, CHANGELOG, SHIP_GATE) advertised the contract as enforced. This advisory is filed primarily because the runtime contradicted an operator-facing security claim. Code-only bugs of comparable shape (auth check missing entirely from a path) would already warrant disclosure; the additional false-promise dimension raises the severity. ## Impact An attacker who reaches the bound port can: - **Read uploaded datasets** rendered in the UI preview, including content of any JSONL/CSV/TXT file the legitimate operator has uploaded for fine-tuning. - **Trigger arbitrary training runs** against any base model the operator has installed locally or that can be downloaded from HuggingFace. - **Trigger HuggingFace Hub pushes** to repositories named via the UI input (subject to the operator's local HF token's scope — typically all repos owned by the operator). - **Cause disk-fill DoS** via the `rx.upload` endpoint (no size cap, no extension filter, no per-session count cap in v1.1.0 / v1.1.1). - **Read model paths** (`source_model_path`, `dataset_path`, `model`, `uploaded_path`) which are user-supplied and bypass the `safe_path()` helper that lives in `backpropagate/ui_security.py` (path validation is dead code on the Reflex surface in v1.1.0 / v1.1.1). The combination of unauthenticated training control, HF push target spoofing, and path-input traversal makes the affected endpoint suitable for both data exfiltration (reading uploaded training data) and supply-chain attacks (pushing tampered model weights to the operator's HF account). The local-only default (no `--share`) reduces exposure to a host-local attacker. The `--share` flag is documented as a "public URL" feature; operators who used `--share --auth user:pass` had no warning that the auth half was inert. ## Patches Fixed in **v1.2.0** (released 2026-05-23). The patch implements real ASGI middleware via `rx.App(api_transformer=basic_auth_transformer)` that gates HTTP routes AND the `/_event` WebSocket upgrade. Four modes (`no_auth_local_only` / `token_auto` / `explicit_creds` / `production`), HMAC-signed cookie validated PRE-`websocket.accept()`, Host + Origin allowlists. The middleware ships alongside a 4-layer defense in depth at the cli.py / ui_app/app.py / rxconfig.py / env-strip surfaces so direct `python -m reflex run` invocations (bypassing the CLI guard) also enforce authentication. Upgrade with: - pip: `pip install --upgrade backpropagate` - npm: `npm install -g @mcptoolshop/backpropagate@latest` Full release notes: https://github.com/mcp-tool-shop-org/backpropagate/blob/main/CHANGELOG.md#120---2026-05-23 ## Workarounds If users cannot upgrade immediately: 1
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| PyPI | backpropagate | — | 1.2.0 |
| npm | @mcptoolshop/backpropagate | — | 1.2.0 |
Remediation: Upgrade to 1.2.0 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.